From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590185; b=Rj3yrKjhBzkxQSvE7TR7lLFqswNJ0QEWAcKaVam+mhtltQ6Vr7QzPG9lF42C9HmAA3YQ sVYz0SSTkGlfaeD/p7nf0cUJYxs7boGNb8mqpv/gpXR7VfBqH1huI/YA6nhdTAM9r7H8b 39C4Q/PVTJ2EViSXrEBHV1AlDDJ+ykTHLDYSVQK7D3wmVkVEZBEs2oZ/eQ38HRowDFyJa DOZCl+Au21P1uCYdX74vk+STioRUDjvmr5yLY8zSoCEX2I2t1S5/SyWUs9ZjRziki91q+ 9w52NcSXYUyeWA96kO0PM+xNTlZbAMrgDPti2dDR9SR4wl8RGKpG/em/XUfRA33RgZQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590185; h=DMARC-Filter:DKIM-Signature:Received:X-MC-Unique: X-Mimecast-MFC-AGG-ID:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received: X-Received:Received:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=xpUEFi2ZZBbuZ6u0vDCmXHOS0UYKMe0sTisc3C2zD4I=; b=z8DzV/1/CZdDJs/Ktw9RLv9tW+aUrr73KyVJSz4jdDoAHBMUnRnJACVKQ7YfSuCv91oZ VmlguE7uPHtzRVcaVjbTXUBwLFriB0mOXI1r1a6Codu/JLouCHcGgIii9PgbZkf0CLkG4 cM05eywMWQZIVvRf0QGNPXyAXBbrSzgEUzanYa3WOdcJUuoZBIec7viBcaggNz+ALHND7 U4w8+zOgC4EjcjQGop7C+qDpKAF77bHYpxQcvXl7YjZiIo4gLdirTIXwHF0YFr/6T96ff JGWbopYECVS7+D7gype9ECqEFbNQa1JQNtEeZQgnIQGsZ/O/J9y0rK6DdIu00c7X8Lg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b="Vkdyga/p"; dkim=pass header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=google header.b=IlrG10FA; arc=none smtp.remote-ip=170.10.133.124 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03ED36073205 for ; Fri, 13 Nov 2026 17:16:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 03ED36073205 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Vkdyga/p; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=google header.b=IlrG10FA DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1794590184; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xpUEFi2ZZBbuZ6u0vDCmXHOS0UYKMe0sTisc3C2zD4I=; b=Vkdyga/pw3GQXac9B2yiXfsJpvMJNwP3DDG1XK7Kqv7HMyB3O9U+eXc4qaPFDc7JiIIrHi /Sx8fU35vh933m2BpCr7lQXKB16qe1+OLJZ9qxuTi49urUHeS2ypAzlSk6kJe9d4AuYZ4n dz4LK0vzd8DqlBu/kAMyAND98O5pvlI= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-280-HtV2JzLsMAephitHyAG2Dw-1; Fri, 13 Nov 2026 12:16:22 -0500 X-MC-Unique: HtV2JzLsMAephitHyAG2Dw-1 X-Mimecast-MFC-AGG-ID: HtV2JzLsMAephitHyAG2Dw_1794590181 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-492e3189fc9so696041f8f.1 for ; Fri, 13 Nov 2026 09:16:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1794590181; x=1795194981; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xpUEFi2ZZBbuZ6u0vDCmXHOS0UYKMe0sTisc3C2zD4I=; b=IlrG10FAiIL0wKT0ujzDv52Qv6p1akkZWOhIk2cgWmeLLWilGIYT9nzEi6tZzdPjim 6nIjZGMn9fMwqI7al81gfMn2ou/MxrbobjdYINKQ+WPkmvl150KVPWOryc9xqj+oedat 8zkmkd6IKhY++lBQlznRPL206BoTn3zY8Mk/MTcSSxV+GA4pgg3Lwz9g6lZpgFmy3w6z wOIYATnAJqXJvOSSJAs8yY8Z7olbyhzuU1L6uLCaIgB68BWMA85Not3FBh6adAB327Zo bDMCG4E50Ea6oy7QSxcs6IsX0Bg4baofFU1bSQGIHinyk++H3tpDXqMYIEP4ylzek86A Z7vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794590181; x=1795194981; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=xpUEFi2ZZBbuZ6u0vDCmXHOS0UYKMe0sTisc3C2zD4I=; b=jPDgXoB68/PbXlYV3BD0zN+ZjwfjSi30cw9AUE7u4i617RngtTkppELaHugMrcoBlI IPdgdIoFj2vUkNnQeY9a1IGbM/0v2SId9Mar7gLLgYUu6K5M28u+hltyl2YunWdnO9lL 8gBE0QKgHPOXH3hcrZZ6LOGxfcOYuzztLrwkA/FOBmI4xmZoCcM9MdHIrglowrAINCoA 7THLbkjxkww/c51YM2UrrETzvMtihNmijYO/DdpEzJWD3DgvGM2j1HHBqAgWEoq4YPI8 H8og8AQwxHfR3zraHVZ2XjbX4ZHdMkv2ALmGg/J7fLZLP53knxh5tBoS1ZtbzxpxUXT0 jIvA== X-Forwarded-Encrypted: i=1; AL+hErE7QsMmu/LV3wLeP+uQl1oFS8NvIrynHNhDVbCU/uJb+BPqBq+rIOKMFxKQcrHgDNzzKv+jdj2llTrqVQ8=@vger.kernel.org X-Gm-Message-State: APuU4Z8TE2i6Wt31/2ldFBLmiYo70eNO2xan5XXiYthGPCy5xepjeVbh 3mZ6VnL8M0wQEcV03mO4+lDVbVesFtkUT3Eo6RlPGxO3/3zzEG2ehNPbnNLX+GvA6wgPzqGro/e iuchdU2guYvpdY0fAukmbiilR8O3tW3WdB8Qc91OU+YnfiVlvQqFsFExTAT/vagtKEQ== X-Gm-Gg: AYBFou2UAIBogUeexF2ef6sHdLGddk8bYCWwVrdaj8Y4lLUGCaPET9ynZ8U1kC4Xs1R HSdOouhGtbGmeucULxWiMt4UYuH4Upoy9Iq6K61cN2wxclYRV6NGGFM11DaNvWUEDuqxn4eqOIf i/aU0E4HCNfZFSU8yFTn/2NQbptPjqtWNvpCvE63vQkj0aKKlN7zYL+k3Aq+GEJ3sF/A9UOov4l j4c+0B8ThUtUfzjhzsJLH108LmJGdObX6KNTSokVh1p/Y9B359dSascQh4DqL/UcKlp1bcgcRu4 Jjp3KjM8X0MPgE1OMFU4D+u4+CvWExmwoSPvqZHFjU7Qdu6uJczK18eL1Gf5si9YMgbzu/1LQ0x zcc8EohYjXHq2UilCr19F3nxIOKKXzLi3ve28MomweDa+IxZNWNW3z0pMpUnivuJezSyApI8LGD V7PysIj1qqTDQ= X-Received: by 2002:a05:6000:29d9:b0:498:b92a:30b with SMTP id ffacd0b85a97d-49c70ed7d88mr4496711f8f.15.1794590181152; Fri, 13 Nov 2026 09:16:21 -0800 (PST) X-Received: by 2002:a05:6000:29d9:b0:498:b92a:30b with SMTP id ffacd0b85a97d-49c70ed7d88mr4496677f8f.15.1794590180627; Fri, 13 Nov 2026 09:16:20 -0800 (PST) Received: from [192.168.0.19] (217.red-88-4-146.dynamicip.rima-tde.net. [88.4.146.217]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-49c7da37b19sm5811907f8f.5.2026.11.13.09.16.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 13 Nov 2026 09:16:19 -0800 (PST) From: Sergio Lopez Date: Fri, 13 Nov 2026 18:15:47 +0100 Subject: [PATCH RFC v3 7/8] vsock: fragment datagrams across receive buffers X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261113-vsock-dgram-support-v3-7-1523c8e9b27e@redhat.com> References: <20261113-vsock-dgram-support-v3-0-1523c8e9b27e@redhat.com> In-Reply-To: <20261113-vsock-dgram-support-v3-0-1523c8e9b27e@redhat.com> To: Stefano Garzarella , Bobby Eshleman , Alexei Starovoitov , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Bryan Tan , Vishnu Dasa , Broadcom internal kernel review list , Stefan Hajnoczi , "Michael S. Tsirkin" , Jason Wang , =?utf-8?q?Eugenio_P=C3=A9rez?= , Xuan Zhuo , Haiyang Zhang , Wei Liu , Dexuan Cui , Shuah Khan , Randy Dunlap Cc: virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, bpf@vger.kernel.org, linux-hyperv@vger.kernel.org, Jonathan Corbet , linux-doc@vger.kernel.org, Sergio Lopez X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=11596; i=slp@redhat.com; h=from:subject:message-id; bh=kpyJbCCj03iMGL/X6J+YE4Nfl4oRX2bBfM6SnpHYzcs=; b=owEBbQKS/ZANAwAKAfRpJ40vDAI1AcsmYgBq90XMXpSaZx9ScadYLhufLMb/C3NivukCyvP0N beIEnjhYOqJAjMEAAEKAB0WIQS+1fz3US2GgJFC6KL0aSeNLwwCNQUCavdFzAAKCRD0aSeNLwwC NY76D/4wYUSzcZwoTAgL3dl82tJ3xi6I3+MS3MEghlBiLorZY080UsDzMPb2lnK0+KoCz9yBDqO FGnZNs6YSUZeKzfeIHHC2RUuN+TPpV1uYuvm9RR5EqTVtv+uowDDh6dbWX72M6/JRU4hsFxeXSH ubJoCqCSM4vJQmiSERkMdKiGaWJPFbXGgv4dPRlbGa1JSDOj9p9Vzge79uU33X50CbElWg99+pX XoxbE76IC36t5rPm6fgZINahuUl6kGnqPGKF+RJIiJdyVoCQ78PRIiZuXDcRPw5Akq3/ooDBr0R ERDklR+C3JsIV9r+jQ+RBUPw2Bxmtxan8usNs4eiHzRSx9iQBhvxEPzk94BYqSw1V4BKzqoxCg+ +X0b64x934zxFLCXa9K07vQyXbqqSs4zmVrMqAdHIvciNarPuYBXHhpdNgXtgNTLaif0/44jO9B JDagJ/o+sxOe+5Zm5dCiiA+/6n62Jm0hJrDtPTJMcTFl8fjKNL3XQrU+52VuYbiA8mZKTPh538E dnVhM1AMLWW9jXEkSa3NE7V9mo8RMye7fBUdU3nn+VRrag89H+fsvB6C9w/w1SqUiaDfF7o3tEi egeBUt9QKUBJhluAa0mKv4fNCBaCgGAdFnMXyHfCsUPqvh+PwcHyshpSF3TIce0C/0TeUddT+Ra onVcqB4VVdfIm7Q== X-Developer-Key: i=slp@redhat.com; a=openpgp; fpr=BED5FCF7512D86809142E8A2F469278D2F0C0235 The guest already uses page-sized RX allocations. A datagram can exceed one RX buffer. Growing every posted buffer to hold a full datagram would increase virtqueue memory use and make small queued datagrams retain large backing allocations. With delayed reads, a bounded receive queue could then fill after only a few messages. Define START and EOM flags for datagram packets. Mark outgoing messages with both flags, and let vhost split a message across guest RX buffers, keeping START on the first fragment and EOM on the last. When a data packet meets a descriptor with no payload space, vhost returns that descriptor with zero used bytes. It drops datagrams but requeues stream and seqpacket data for a later buffer. Reassemble consecutive fragments in the guest before tap or socket delivery. Bound a partial message to 64 fragments and 64 KiB. Discard incomplete messages on malformed packets, a new START, a peer mismatch, an intervening non-datagram packet, or virtqueue teardown. Require complete framing for host and loopback ingress. A QEMU reproducer now delivers a 9 KiB datagram as one message and all 16 messages of a delayed-read burst. Paired host/guest selftests cover 64 KiB messages and the burst through both a userspace backend and the patched Linux vhost backend, with stream and seqpacket controls. A nested vhost-vsock guest posting header-only RX buffers also passes stream and seqpacket receive tests. Signed-off-by: Sergio Lopez --- drivers/vhost/vsock.c | 15 +++++ include/uapi/linux/virtio_vsock.h | 8 +++ net/vmw_vsock/virtio_transport.c | 115 ++++++++++++++++++++++++++++++-- net/vmw_vsock/virtio_transport_common.c | 11 ++- 4 files changed, 141 insertions(+), 8 deletions(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index f4fb2ac732f5..1ff4a9aff907 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -185,6 +185,19 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, * buffer, we split it using multiple buffers. */ if (payload_len > iov_len - sizeof(*hdr)) { + if (iov_len == sizeof(*hdr)) { + /* Connected sockets must retry with the next buffer. */ + if (le16_to_cpu(hdr->type) == + VIRTIO_VSOCK_TYPE_DGRAM) + kfree_skb(skb); + else + virtio_vsock_skb_queue_head( + &vsock->send_pkt_queue, skb); + vhost_add_used(vq, head, 0); + added = true; + continue; + } + payload_len = iov_len - sizeof(*hdr); /* As we are copying pieces of large packet's buffer to @@ -244,6 +257,8 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, */ if (VIRTIO_VSOCK_SKB_CB(skb)->offset < skb->len) { hdr->flags |= cpu_to_le32(flags_to_restore); + if (le16_to_cpu(hdr->type) == VIRTIO_VSOCK_TYPE_DGRAM) + hdr->flags &= ~cpu_to_le32(VIRTIO_VSOCK_DGRAM_START); /* We are queueing the same skb to handle * the remaining bytes, and we want to deliver it diff --git a/include/uapi/linux/virtio_vsock.h b/include/uapi/linux/virtio_vsock.h index 27b4b2b8bf13..e1937f756eeb 100644 --- a/include/uapi/linux/virtio_vsock.h +++ b/include/uapi/linux/virtio_vsock.h @@ -101,6 +101,14 @@ enum virtio_vsock_shutdown { enum virtio_vsock_rw { VIRTIO_VSOCK_SEQ_EOM = 1, VIRTIO_VSOCK_SEQ_EOR = 2, + /* + * With VIRTIO_VSOCK_F_DGRAM, START marks the first RW packet of a + * datagram and EOM marks the last. Both are set for a datagram that + * fits in one packet. Fragments must be consecutive on the receive + * virtqueue. Each packet's len is its fragment length. + */ + VIRTIO_VSOCK_DGRAM_EOM = VIRTIO_VSOCK_SEQ_EOM, + VIRTIO_VSOCK_DGRAM_START = 4, }; #endif /* _UAPI_LINUX_VIRTIO_VSOCK_H */ diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index 87a96e94c3c2..c8c58a7dcec4 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -54,6 +54,8 @@ struct virtio_vsock { bool rx_run; int rx_buf_nr; int rx_buf_max_nr; + struct sk_buff_head dgram_rx_queue; + u32 dgram_rx_len; u32 guest_cid; bool seqpacket_allow; @@ -312,7 +314,7 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk) static void virtio_vsock_rx_fill(struct virtio_vsock *vsock) { int total_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE; - struct scatterlist pkt, *p; + struct scatterlist pkt; struct virtqueue *vq; struct sk_buff *skb; int ret; @@ -325,9 +327,9 @@ static void virtio_vsock_rx_fill(struct virtio_vsock *vsock) break; memset(skb->head, 0, VIRTIO_VSOCK_SKB_HEADROOM); + virtio_vsock_skb_put(skb, total_len - VIRTIO_VSOCK_SKB_HEADROOM); sg_init_one(&pkt, virtio_vsock_hdr(skb), total_len); - p = &pkt; - ret = virtqueue_add_sgs(vq, &p, 0, 1, skb, GFP_KERNEL); + ret = virtqueue_add_inbuf(vq, &pkt, 1, skb, GFP_KERNEL); if (ret < 0) { kfree_skb(skb); break; @@ -661,6 +663,93 @@ virtio_transport_dgram_allow_check(struct vsock_sock *vsk, u32 cid, u32 port) return dgram_allow; } +#define VIRTIO_VSOCK_DGRAM_MAX_FRAGS 64 + +/* The RX worker holds rx_lock while assembling fragments from one virtqueue. */ +static void virtio_vsock_dgram_reset(struct virtio_vsock *vsock) +{ + skb_queue_purge(&vsock->dgram_rx_queue); + vsock->dgram_rx_len = 0; +} + +static bool virtio_vsock_dgram_same_peer(struct sk_buff *first, + struct sk_buff *next) +{ + const struct virtio_vsock_hdr *a = virtio_vsock_hdr(first); + const struct virtio_vsock_hdr *b = virtio_vsock_hdr(next); + + return a->src_cid == b->src_cid && a->dst_cid == b->dst_cid && + a->src_port == b->src_port && a->dst_port == b->dst_port; +} + +static struct sk_buff * +virtio_vsock_dgram_reassemble(struct virtio_vsock *vsock, struct sk_buff *skb) +{ + struct sk_buff_head *queue = &vsock->dgram_rx_queue; + struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); + struct sk_buff *assembled, *fragment; + u32 flags = le32_to_cpu(hdr->flags); + int offset = 0; + + if (le16_to_cpu(hdr->op) != VIRTIO_VSOCK_OP_RW || + flags & ~(VIRTIO_VSOCK_DGRAM_START | VIRTIO_VSOCK_DGRAM_EOM)) + goto drop_partial; + + /* START also resynchronizes after an abandoned datagram. */ + if (flags & VIRTIO_VSOCK_DGRAM_START) + virtio_vsock_dgram_reset(vsock); + else if (skb_queue_empty(queue)) + goto drop_skb; + + fragment = skb_peek(queue); + if (fragment && !virtio_vsock_dgram_same_peer(fragment, skb)) + goto drop_partial; + if (skb->len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE - vsock->dgram_rx_len || + skb_queue_len(queue) >= VIRTIO_VSOCK_DGRAM_MAX_FRAGS || + (!(flags & VIRTIO_VSOCK_DGRAM_EOM) && !skb->len)) + goto drop_partial; + + if (flags & VIRTIO_VSOCK_DGRAM_EOM && skb_queue_empty(queue)) + return skb; + + vsock->dgram_rx_len += skb->len; + skb_queue_tail(queue, skb); + if (!(flags & VIRTIO_VSOCK_DGRAM_EOM)) + return NULL; + + assembled = virtio_vsock_alloc_skb(VIRTIO_VSOCK_SKB_HEADROOM + + vsock->dgram_rx_len, GFP_KERNEL); + if (!assembled) + goto reset; + virtio_vsock_skb_put(assembled, vsock->dgram_rx_len); + fragment = skb_peek(queue); + memcpy(virtio_vsock_hdr(assembled), virtio_vsock_hdr(fragment), + sizeof(*hdr)); + hdr = virtio_vsock_hdr(assembled); + hdr->len = cpu_to_le32(vsock->dgram_rx_len); + hdr->flags = cpu_to_le32(VIRTIO_VSOCK_DGRAM_START | + VIRTIO_VSOCK_DGRAM_EOM); + skb_queue_walk(queue, fragment) { + if (skb_store_bits(assembled, offset, fragment->data, + fragment->len)) { + kfree_skb(assembled); + goto reset; + } + offset += fragment->len; + } + virtio_vsock_dgram_reset(vsock); + return assembled; + +drop_partial: + virtio_vsock_dgram_reset(vsock); +drop_skb: + kfree_skb(skb); + return NULL; +reset: + virtio_vsock_dgram_reset(vsock); + return NULL; +} + static void virtio_transport_rx_work(struct work_struct *work) { struct virtio_vsock *vsock = @@ -697,7 +786,8 @@ static void virtio_transport_rx_work(struct work_struct *work) /* Drop short/long packets */ if (unlikely(len < sizeof(*hdr) || - len > virtio_vsock_skb_len(skb))) { + len > sizeof(*hdr) + skb->len)) { + virtio_vsock_dgram_reset(vsock); kfree_skb(skb); continue; } @@ -705,6 +795,7 @@ static void virtio_transport_rx_work(struct work_struct *work) hdr = virtio_vsock_hdr(skb); payload_len = le32_to_cpu(hdr->len); if (unlikely(payload_len > len - sizeof(*hdr))) { + virtio_vsock_dgram_reset(vsock); kfree_skb(skb); continue; } @@ -713,12 +804,19 @@ static void virtio_transport_rx_work(struct work_struct *work) if (le16_to_cpu(hdr->type) == VIRTIO_VSOCK_TYPE_DGRAM && (!vsock->dgram_allow || le64_to_cpu(hdr->dst_cid) != vsock->guest_cid)) { + virtio_vsock_dgram_reset(vsock); kfree_skb(skb); continue; } - if (payload_len) - virtio_vsock_skb_put(skb, payload_len); + pskb_trim_unique(skb, payload_len); + if (le16_to_cpu(hdr->type) == VIRTIO_VSOCK_TYPE_DGRAM) { + skb = virtio_vsock_dgram_reassemble(vsock, skb); + if (!skb) + continue; + } else if (!skb_queue_empty(&vsock->dgram_rx_queue)) { + virtio_vsock_dgram_reset(vsock); + } virtio_transport_deliver_tap_pkt(skb); @@ -730,7 +828,8 @@ static void virtio_transport_rx_work(struct work_struct *work) } while (!virtqueue_enable_cb(vq)); out: - if (vsock->rx_buf_nr < vsock->rx_buf_max_nr / 2) + if (!vsock->rx_buf_nr || + vsock->rx_buf_nr < vsock->rx_buf_max_nr / 2) virtio_vsock_rx_fill(vsock); out_nofill: mutex_unlock(&vsock->rx_lock); @@ -824,6 +923,7 @@ static void virtio_vsock_vqs_del(struct virtio_vsock *vsock) mutex_lock(&vsock->rx_lock); while ((skb = virtqueue_detach_unused_buf(vsock->vqs[VSOCK_VQ_RX]))) kfree_skb(skb); + virtio_vsock_dgram_reset(vsock); mutex_unlock(&vsock->rx_lock); mutex_lock(&vsock->tx_lock); @@ -865,6 +965,7 @@ static int virtio_vsock_probe(struct virtio_device *vdev) mutex_init(&vsock->tx_lock); mutex_init(&vsock->rx_lock); + skb_queue_head_init(&vsock->dgram_rx_queue); mutex_init(&vsock->event_lock); skb_queue_head_init(&vsock->send_pkt_queue); INIT_WORK(&vsock->rx_work, virtio_transport_rx_work); diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index c540bc40755a..23f141cd786a 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -275,6 +275,13 @@ static struct sk_buff *virtio_transport_alloc_skb(struct virtio_vsock_pkt_info * hdr->flags |= cpu_to_le32(VIRTIO_VSOCK_SEQ_EOR); } } + if (info->type == VIRTIO_VSOCK_TYPE_DGRAM) { + struct virtio_vsock_hdr *hdr = virtio_vsock_hdr(skb); + + /* Vhost may split this message across guest RX buffers. */ + hdr->flags |= cpu_to_le32(VIRTIO_VSOCK_DGRAM_START | + VIRTIO_VSOCK_DGRAM_EOM); + } if (info->reply) virtio_vsock_skb_set_reply(skb); @@ -1877,7 +1884,9 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, * datagrams are silently dropped (no RST). */ if (le16_to_cpu(hdr->type) == VIRTIO_VSOCK_TYPE_DGRAM) { - if (le16_to_cpu(hdr->op) != VIRTIO_VSOCK_OP_RW) + if (le16_to_cpu(hdr->op) != VIRTIO_VSOCK_OP_RW || + le32_to_cpu(hdr->flags) != + (VIRTIO_VSOCK_DGRAM_START | VIRTIO_VSOCK_DGRAM_EOM)) goto free_pkt; sk = vsock_find_bound_dgram_socket_net(&dst, net); -- 2.56.0